1. Field of the Invention
The present invention relates to network-based computer applications. More specifically, the present invention relates to a method and an apparatus that facilitates associating lockouts with a user identifier for accessing network applications.
2. Related Art
Modern Enterprise computing systems distribute computer application programs across application servers accessible across a network such as the World Wide Web. Typically, these application programs require a user to authenticate prior to allowing the user to access the application. Many of these web-based computer applications rely on password-based authentication.
Password based authentication depends upon using a limited length password selected from a known character set. It is possible, therefore, for an adversary to mount a brute force attack by exhaustively trying different passwords to gain unauthorized entry to the application. Administrators employ many techniques to counter this threat, such as forcing a user to change the password periodically, requiring a minimum length password, requiring a complex password, and the like.
These techniques do not, however, obviate a brute force attack on the system. The system can, however, deny entry during a brute force attack by imposing a lockout on the account being attacked. A brute force attack can be detected by observing a specified number of unsuccessful attempts to access the application with an incorrect password. When a brute force attack is detected, the system prevents the user's account from accessing the application for a specified amount of time, or until an administrator unlocks the user's account.
While effective at preventing unauthorized entry into the application, a lockout has the undesired effect of locking out the legitimate user of the account until the account has been reset-either automatically or by the administrator. This constitutes a denial-of-service attack where an adversary can prevent the legitimate user from accessing the application.
What is needed is a method and an apparatus that facilitates allowing a legitimate user of an account to access a web-based application while preventing a denial of service attack from an adversary.